{"id":83443,"date":"2020-05-31T13:42:09","date_gmt":"2020-05-31T11:42:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls"},"modified":"2020-05-31T13:42:09","modified_gmt":"2020-05-31T11:42:09","slug":"ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","title":{"rendered":"AddTrusti juuresertifikaadi aegumine p\u00f5hjustas t\u00f5rkeid s\u00fcsteemides, kus on kasutusel OpenSSL ja GnuTLS.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

30. mai l\u00f5ppes 20-aastane AddTrusti juuresertifikaadi kehtivusaeg AddTrust<\/a><\/noindex>, mis IRC-d, mis peeti t\u00f5siseks takistuseks uute tulijate arutlustesse kaasamisel. Samuti on m\u00e4rgitud, et IRC protokoll on moraalselt ja tehniliselt vananenud, mist\u00f5ttu ei ole see t\u00e4nap\u00e4eval nii mugav kui sooviks, tihti blokeeritakse tulem\u00fc\u00fcrides ja see ei paku piisavaid t\u00f6\u00f6riistu r\u00e4mpsposti ja suhtlemisnormide rikkumiste kaitsmiseks.<\/a><\/noindex> \u00fche suurima sertifitseerimiskeskuse Sectigo (Comodo) sertifikaatidesse ristallkiri (cross-signed) genereerimiseks. Ristallkiri tagas \u00fchilduvuse aegunud seadmetega, milles ei olnud uut USERTrusti juuresertifikaati lisatud. <\/p>\n

\"AddTrusti<\/a><\/noindex><\/center><\/p>\n

Teoreetiliselt pidi AddTrusti juuresertifikaadi kehtivuse l\u00f5pp tooma kaasa vaid \u00fchilduvuse katkemise aegunud s\u00fcsteemidega (Android 2.3, Windows XP, Mac OS X 10.11, iOS 9 jne), sest teine juuresertifikaat, mida ristallkirjas kasutatakse, j\u00e4\u00e4b kehtima ja kaasaegsed brauserid arvestavad sellega usaldusketi kontrollimisel. Practikas leiti<\/a><\/noindex> probleeme ristallkirjade kontrollimisel TLS-klientides, sealhulgas OpenSSL 1.0.x ja GnuTLS p\u00f5histes. Turvaline \u00fchendus ei hakanud enam t\u00f6\u00f6tama, kui serveris kasutati AddTrusti juuresertifikaadiga seotud Sectigo sertifikaati, mis t\u00f5i esile vea sertifikaadi aegumise kohta.<\/p>\n

Kui kaasaegsete brauserite kasutajad ei m\u00e4rganud AddTrust'i juuresertifikaadi aegumist ristallkirjastatud Sectigo sertifikaate t\u00f6\u00f6deldes, siis erinevates kolmandate osapoolte rakendustes ja serverite t\u00f6\u00f6tlejatest hakkasid ilmuma probleemid, mis t\u00f5id kaasa rikkumine<\/a><\/noindex> paljude<\/a><\/noindex> infrastruktuuride t\u00f6\u00f6 katkemise, mis kasutavad kr\u00fcpteeritud sidekanaleid komponentide vahelise suhtlemise jaoks. <\/p>\n

N\u00e4iteks esines probleeme<\/a><\/noindex> juurdep\u00e4\u00e4suga m\u00f5nedele pakettide hoidlatele Debianis ja Ubuntu's (apt hakkas sertifikaadi kontrolli viga andma), hakkasid skriptide kaudu tegelemised «curl» ja «wget» eba\u00f5nnestuma ning esinevad vead Git'i kasutamisel. katkes<\/a><\/noindex> Roku striimimise platvormi t\u00f6\u00f6, t\u00f6\u00f6tlejad lakkasid t\u00f6\u00f6st Stripe<\/a><\/noindex> ja DataDog<\/a><\/noindex>, hakkasid toimuma kokkuvarisemised<\/a><\/noindex> Heroku rakendustes, lakkasid<\/a><\/noindex> \u00fchenduma OpenLDAP kliendid, ilmnesid probleemid SMTPS ja SMTP serveritele posti saatmisel STARTTLS-iga. Lisaks ilmnesid probleemid erinevates Ruby-, PHP- ja Python-skriptides, mis kasutasid http-klientide moodulit. Brauserites puudutab<\/a><\/noindex> Epiphany, kus reklaamiblokeerimise nimekirjad ei hakanud enam laadima.<\/p>\n

Go keeles kirjutatud programmid ei ole selle probleemi all, kuna Go pakub omatehtud<\/a><\/noindex> TLS.<\/p>\n

Oletati<\/a><\/noindex>, et probleem m\u00f5jutab vanade distributsioonide v\u00e4ljaandeid (sealhulgas Debian 9, Ubuntu 16.04, RHEL 6\/7<\/a><\/noindex>) milles kasutatakse probleemseid OpenSSL harusid, kuid probleem ilmnes<\/a><\/noindex> ka APT paketihalduri t\u00f6\u00f6s, k\u00e4esolevate Debian 10 ja Ubuntu 18.04\/20.04 v\u00e4ljaannetes, kuna APT kasutab GnuTLS'i teeki. Probleemi olemus seisneb selles, et paljud TLS\/SSL teegid t\u00f5lgendavad sertifikaati kui lineaarselt ahelat, samas kui vastavalt RFC 4158-le v\u00f5ib sertifikaat esindada suunatud jaotatud ts\u00fcklit ja mitmeid usaldusv\u00e4\u00e4rsuse tugipunkte, mida tuleb arvestada. Sellest probleemist OpenSSL-is ja GnuTLS-is oli<\/a><\/noindex> teada<\/a><\/noindex> on r\u00e4\u00e4gitud juba aastaid.<\/a><\/noindex>OpenSSL-is oli probleem lahendatud harus 1.1.1, kuid GnuTLS<\/a><\/noindex> j\u00e4\u00e4nud veel parandatud<\/a><\/noindex>.<\/p>\n

Juhiseks vea k\u00f5rvaldamiseks pakutakse, et kustutada s\u00fcsteemi hoidlast sertifikaat «AddTrust External CA Root» (n\u00e4iteks kustutada \/etc\/ca-certificates.conf ja \/etc\/ssl\/certs, seej\u00e4rel k\u00e4ivitada «update-ca-certificates -f -v»), mille j\u00e4rel hakkab OpenSSL normaalselt t\u00f6\u00f6tlema ristkirjaga allkirjastatud sertifikaate, millega see on seotud. APT paketihalduri kasutamisel v\u00f5ib oma riski alusel eri p\u00e4ringute jaoks keelata sertifikaatide kontrollimise (n\u00e4iteks «apt-get update -o Acquire::https::download.jitsi.org::Verify-Peer=false»). <\/p>\n

Probleemi blokeerimiseks Fedora<\/a><\/noindex> ja RHEL<\/a><\/noindex> soositakse lisada AddTrust sertifikaat musta nimekirja:<\/p>\n

trust dump —filter «pkcs11:id=;type=cert» \
\n > \/etc\/pki\/ca-trust\/source\/blacklist\/addtrust-external-root.p11-kit
\n update-ca-trust extract<\/p>\n

Kuid see meetod ei toimi<\/a><\/noindex> GnuTLS'i puhul ei lahenda probleemi (nt 'wget' rakenduse k\u00e4ivitamisel j\u00e4tkuvalt esitatakse sertifikaadi kontrollimise viga).<\/p>\n

Serveripoolt saab<\/a><\/noindex> muuta<\/a><\/noindex> sertifikaatide loetlemine usaldusketis, mille server saadab kliendile (kui «AddTrust External CA Root» seotud sertifikaat eemaldatakse loendist, siis klient saab edukalt kontrolli l\u00e4bi). Uue usaldusketi kontrollimiseks ja genereerimiseks v\u00f5ib kasutada teenust. whatsmychaincert.com<\/a><\/noindex>. Sectigo samuti pakkus<\/a><\/noindex> alternatiivne ristkirjaga allkirjastatud vahe-sertifikaat «AAA Certificate Services<\/a><\/noindex>«, mis kehtib kuni 2028. aastani ja v\u00f5imaldab s\u00e4ilitada \u00fchilduvust vanemate operatsioonis\u00fcsteemide versioonidega.<\/p>\n

Lisa: Probleem puudutab ka LibreSSL. n\u00e4itab ennast<\/a><\/noindex> LibreSSL-is.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 (cross-signed) \u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u0445 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0445 \u0446\u0435\u043d\u0442\u0440\u043e\u0432 Sectigo (Comodo). \u041f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u0430\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u044c \u0441 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u0432 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 USERTRust. \u0422\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043b\u0438\u0448\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":83444,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47AddTrusti juuresertifikaadi aegumine p\u00f5hjustas t\u00f5rkeid OpenSSL ja GnuTLS s\u00fcsteemides | ProHoster","description":"30. mai l\u00f5ppes 20-aastane AddTrusti juursertifikaadi kehtivusaeg, mis","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u0442\u0430\u0440\u0435\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0441\u0431\u043e\u044f\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 OpenSSL \u0438 GnuTLS | ProHoster","og:description":"30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-31T11:42:09+00:00","article:modified_time":"2020-05-31T11:42:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83443","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:17:29","updated":"2022-09-28 18:33:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/83443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=83443"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/83443\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/83444"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=83443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=83443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=83443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}